Title

Security constraints

Identifier

SWIM-SERV-160

Requirement

A service description shall include or refer to information about the security constraints which apply to accessing and using the service.

Rationale

This requirement ensures that a service consumer is aware of any restrictions on the access and use of the service.

Verification

Completeness: Verify that the elements included cover the required security constraints.

Consistency: Not Applicable.

Correctness: Not Applicable.

Examples/Notes

Example security constraints:

• Authentication:

  • Statement of the authentication mechanisms used on consumer and provider side;

  • Statement of the failed authentication constraints;

  • Identity tokens;

• Authorisation:

  • Statement on the authorisation mechanism used;

  • Credentials used for the authorisation;

  • Levels of authorisation;

• Confidentiality:

  • Statement of the confidentiality offered by the service (e.g. message, transport, network, none…);

  • Elements of the payload whose confidentiality is required or provided (whole payload, body, specific sub-elements…);

  • Cryptographic algorithms and key sizes;

• Integrity:

  • Statement of the integrity offered by the service (e.g. message, transport, network, none…);

  • Elements of the payload whose integrity is required or provided (whole payload, body, specific sub-elements…);

  • Cryptographic algorithms and key sizes.

Level of Implementation

Mandatory